Privacy Policy
1. Overview
OC Study ("we," "us," or "our") operates the SAT and ACT preparation platform available at ocstudy.com (the "Service"). This Privacy Policy applies to all users of the Service, including students and their parents or guardians.
We collect only the information necessary to provide the Service. We do not sell your personal data. We do not use student data for behavioral advertising. We do not share your information with third parties except as described in this Policy.
2. Information We Collect
Information you provide
| Data | Who provides it | Why we collect it |
|---|---|---|
| First and last name | Student / Parent | Account identification |
| Email address | Student / Parent | Account login, communications |
| Date of birth | Student | Age verification, COPPA compliance |
| Grade level | Student | Personalize content and study plans |
| Phone number | Student / Parent | Account verification, security |
| Password (hashed) | Student / Parent | Account security |
| Exam target (SAT / ACT) | Student | Customize question bank and plans |
| Billing information | Parent / Subscriber | Process subscription payments |
Information we collect automatically
- Usage data: Questions answered, scores, time spent, sessions, streaks, and performance trends
- Device data: Browser type, operating system, screen size, and general device type
- Log data: IP address, access timestamps, pages visited, and error events
- Cookies and local storage: Session tokens and preference settings (see Section 11)
We do not collect sensitive data such as Social Security numbers, government ID, financial account numbers, or biometric data.
3. How We Use Your Information
We use the information we collect solely to provide, maintain, and improve the Service:
- Create and manage your account
- Deliver personalized practice questions and study plans
- Track progress, identify weak areas, and predict score ranges
- Process payments and manage subscriptions
- Send transactional emails (account confirmation, password reset, subscription receipts)
- Respond to support inquiries
- Detect, investigate, and prevent fraud or abuse
- Comply with legal obligations
We do not use your data for targeted or behavioral advertising, nor do we build advertising profiles from student activity.
4. Children's Privacy (COPPA Compliance)
OC Study is designed for students, including those under 13. We comply fully with the Children's Online Privacy Protection Act (COPPA) and the FTC's 2026 COPPA Rule amendments.
For students under 13 ("children"), we require verifiable parental consent before collecting any personal information beyond what is strictly necessary to obtain that consent. Specifically:
- We do not create standalone accounts for children under 13 — a parent or guardian account must be established first
- We collect only the minimum data necessary to provide the educational Service
- We do not disclose children's personal information to third parties except as permitted by COPPA (service providers operating on our behalf under a confidentiality obligation)
- We do not use children's data for advertising or to build marketing profiles
- AI-powered features for students under 13 require separate, explicit parental consent
If you believe your child has provided personal information without parental consent, contact us immediately at privacy@ocstudy.com and we will delete it promptly.
5. Parental Rights & Access
Parents and guardians of minor users have the right to:
- Review the personal information collected about their child
- Correct inaccurate information
- Delete their child's account and associated personal data
- Refuse further collection or use of their child's data
- Withdraw consent for AI-powered features at any time
To exercise these rights, email privacy@ocstudy.com from the email address associated with your parent account. We may request identity verification before fulfilling requests to protect student data.
Requests will be fulfilled within 30 days. Deletion of a child's account will result in permanent removal of their personal data from our active systems, subject to our retention policy for legal and safety obligations.
7. No Behavioral Advertising
We do not use student data — including data from users under 18 — to deliver behavioral or targeted advertising. We do not allow third-party ad networks to collect data from students on our platform.
We do not build advertising profiles from student performance data, browsing history, or usage patterns. Any communications we send users are transactional (e.g., receipts, password resets, study reminders) or directly related to the educational Service.
8. AI Features & Data Use
OC Study uses AI and machine learning to analyze your performance data and generate personalized study plans, identify skill gaps, and predict score improvement trajectories. This processing occurs within our platform and uses only your own activity data.
We do not use student performance data to train commercial AI models for sale or licensing to third parties. AI analysis is performed solely to improve your individual experience within the Service.
For students under 18, AI-powered personalization features require parental consent before activation. Parents may opt out at any time.
9. Data Retention
We retain your personal information for as long as your account is active or as needed to provide the Service. If you close your account:
- Personal profile data (name, email, DOB, grade) is deleted within 90 days
- Performance and usage data may be retained in de-identified, aggregated form for service improvement
- Billing records are retained for 7 years to comply with financial regulations
- Data may be retained longer if required by law or for pending legal matters
For children's data specifically, we do not retain personal information longer than reasonably necessary to fulfill the educational purpose for which it was collected.
10. Security
We implement reasonable technical and organizational measures to protect your personal information against unauthorized access, loss, misuse, or alteration. These include:
- Encrypted data transmission (HTTPS/TLS)
- Hashed and salted password storage — we never store passwords in plain text
- Session token authentication with automatic expiration
- Access controls limiting data access to authorized personnel only
- Regular security reviews
No method of transmission over the internet or electronic storage is 100% secure. While we take reasonable precautions, we cannot guarantee absolute security. If you suspect your account has been compromised, contact us immediately at support@ocstudy.com.
12. Your Rights
Depending on your location, you may have the following rights regarding your personal information:
- Access: Request a copy of the personal data we hold about you
- Correction: Request correction of inaccurate information
- Deletion: Request deletion of your account and personal data
- Portability: Request your data in a portable format
- Objection: Object to certain processing of your data
- Restriction: Request we limit processing in certain circumstances
To exercise any of these rights, email privacy@ocstudy.com with your request. We will respond within 30 days. We may verify your identity before fulfilling your request.
We will not discriminate against you for exercising your privacy rights.
13. FERPA
The Family Educational Rights and Privacy Act (FERPA) protects the privacy of student education records at institutions that receive federal funding. OC Study is not a school or educational institution and does not receive federal education funding, so FERPA does not directly govern our platform.
However, we voluntarily align with FERPA's principles: we treat student performance data as confidential educational records, we do not share it without parental or student consent (as applicable), and we support parents' and eligible students' rights to access and correct their own data.
14. State-Specific Privacy Rights
Depending on the state you reside in, you may have additional privacy rights under applicable state law. We honor these rights regardless of whether your state's law technically applies to us, because we believe privacy is a right — not a compliance checkbox.
California (CCPA / CPRA)
California residents have the right to: (a) know what personal information we collect, use, disclose, and sell; (b) delete personal information we hold; (c) correct inaccurate personal information; (d) opt out of the sale or sharing of personal information; (e) limit use of sensitive personal information; and (f) non-discrimination for exercising these rights. We do not sell personal information, including information about minors, and we do not share it for cross-context behavioral advertising. California residents may also request information under the "Shine the Light" law (California Civil Code § 1798.83) about categories of personal information disclosed to third parties for their direct marketing purposes — we do not make such disclosures. Submit California-specific requests to privacy@ocstudy.com with the subject line "California Privacy Request."
Virginia, Colorado, Connecticut & Other State Laws
Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), and other states with active consumer privacy laws have the right to access, correct, delete, and obtain a portable copy of their personal data, as well as to opt out of targeted advertising and the sale of personal data. We do not engage in either practice. To submit a request, email privacy@ocstudy.com. We will respond within 45 days (extendable by an additional 45 days with notice). If we deny your request, you have the right to appeal by emailing us with the subject line "Privacy Rights Appeal."
Nevada
Nevada residents may opt out of the "sale" of personal information under Nevada SB 220. We do not sell personal information as defined under Nevada law, but you may submit a verified opt-out request to privacy@ocstudy.com.
International Users
Our Service is directed at users in the United States. If you access the Service from outside the United States, your data will be processed in the US and subject to US law. We do not target or knowingly collect data from individuals in the European Economic Area or United Kingdom. If you are located in such a jurisdiction and believe your data has been collected, contact us for deletion.
15. Data Breach Notification
In the event of a data breach that compromises personal information, we will:
- Notify affected users and, where applicable, parents or guardians of affected minor users within 72 hours of discovering the breach, or as soon as reasonably practicable given the circumstances
- Notify relevant regulatory authorities as required by applicable state and federal law
- Notify any linked school districts or institutional partners whose students' data was affected
- Provide a clear description of: (a) the nature of the breach; (b) categories and approximate number of records affected; (c) likely consequences; (d) measures taken or proposed to address the breach
We will not delay breach notification on the grounds that an investigation is ongoing unless law enforcement specifically requests a delay. Breach notification will be sent to the email address on your account and/or posted prominently within the Service.
16. Third-Party Links & Services
Our Service may contain links to third-party websites, tools, or resources (such as College Board, Khan Academy, or other educational reference sites). These links are provided for your convenience and do not constitute an endorsement. We have no control over the content, privacy practices, or data collection of third-party sites, and this Privacy Policy does not apply to them.
We encourage you to review the privacy policy of any third-party site before providing personal information. We are not responsible for the privacy practices or content of any third party.
Any third-party service providers we engage to operate our Service (payment processors, email delivery, etc.) are bound by contractual obligations to process data only as directed by us and to maintain appropriate security measures. We do not allow service providers to use your data for their own purposes.
17. Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes — particularly changes that affect how we handle children's data — we will notify you by email and/or by displaying a prominent notice within the Service at least 14 days before the changes take effect.
For changes that require fresh parental consent under COPPA, we will obtain that consent before the change takes effect for accounts with users under 13.
The date at the top of this page always reflects when this Policy was last updated.
18. Contact Us
For privacy-related questions, data requests, or COPPA concerns, please contact us:
OC Study — Privacy Team
Email: privacy@ocstudy.com
Support: support@ocstudy.com
Website: ocstudy.com